feat(provision): idempotent setup for local dev and remote server

docs/development.md

@@ -13,8 +13,23 @@ Setup, workflow, building assets, and testing for XAMXAM development.
 
 ## One-time setup
 
-From the repo root, install dependencies (manually — there is no `just` recipe
-for these):
+From the repo root, run the provisioning script:
+
+```bash
+just provision
+```
+
+This is **idempotent** and safe to re-run. It:
+
+1. Ensures `app/.env` has an `APP_KEY` — **never overwrites an existing key**
+   (it prints a message and keeps the current one so encrypted credentials stay
+   decryptable).
+2. Installs Composer deps (`composer install`) and JS deps (`npm ci`).
+3. Runs the DB schema + migrations (`just migrate`).
+4. Checks the first-admin-password state and tells you if `/admin/` is still
+   unauthenticated.
+
+If you prefer to run the steps manually, or `just` isn't installed yet:
 
 ```bash
 composer install           # PHP deps (vendor/)
@@ -26,8 +41,7 @@ just migrate               # create/update the SQLite DB from schema + migration
 — it still clones the old `php-live-reload` library and creates legacy
 `admin/data/` directories. Live-reload now ships inside the app
 (`app/public/live-reload.php`), and assets are built with rolldown/lightningcss,
-not the live-reload watcher. Prefer the explicit `composer install` + `npm ci`
-above.
+not the live-reload watcher. Prefer `just provision`.
 
 ### APP_KEY and the app/.env file
 
@@ -40,17 +54,19 @@ password, PeerTube credentials, and Nextcloud WebDAV sync) requires an
 APP_KEY=<base64-encoded 32 random bytes>
 ```
 
-Generate one with:
+Generate one manually with:
 
 ```bash
 php -r 'echo "APP_KEY=" . base64_encode(random_bytes(32)) . PHP_EOL;' > app/.env
 chmod 600 app/.env
 ```
 
-`app/.env` must **never** be committed. If the file is missing, the public site
-still runs but any path that reads encrypted credentials throws
-`RuntimeException: APP_KEY not found`. On a fresh clone, create it before
-relying on SMTP/PeerTube/Nextcloud features.
+`app/.env` must **never** be committed. `just provision` only creates `app/.env`
+(or appends `APP_KEY`) when the key is absent — if the value already exists it
+is left untouched so existing encrypted credentials (SMTP password, PeerTube
+OAuth, Nextcloud WebDAV) remain decryptable. If the file is missing, the public
+site still runs but any path that reads encrypted credentials throws
+`RuntimeException: APP_KEY not found`.
 
 ### First admin login